1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <fuzzer/FuzzedDataProvider.h>
17 #include "jsvaluerefislinkedlistiterator_fuzzer.h"
18 #include "ecmascript/containers/containers_list.h"
19 #include "ecmascript/containers/containers_private.h"
20 #include "ecmascript/ecma_string-inl.h"
21 #include "ecmascript/ecma_vm.h"
22 #include "ecmascript/global_env.h"
23 #include "ecmascript/js_handle.h"
24 #include "ecmascript/js_tagged_value.h"
25 #include "ecmascript/napi/include/jsnapi.h"
26 #include "ecmascript/js_thread.h"
27 #include "ecmascript/js_global_object.h"
28 #include "ecmascript/napi/jsnapi_helper.h"
29 #include "ecmascript/linked_hash_table.h"
30 #include "ecmascript/ecma_runtime_call_info.h"
31 #include "ecmascript/containers/containers_hashset.h"
32 #include "ecmascript/common.h"
33 #include "ecmascript/frames.h"
34 #include "ecmascript/tagged_list.h"
35 #include "ecmascript/linked_hash_table.h"
36 #include "ecmascript/js_api/js_api_list.h"
37 #include "ecmascript/js_api/js_api_linked_list.h"
38 #include "ecmascript/js_api/js_api_linked_list_iterator.h"
39 #include "ecmascript/object_factory.h"
40 #include "ecmascript/js_set.h"
41 #include "ecmascript/js_set_iterator.h"
42 #include "ecmascript/js_map.h"
43 #include "ecmascript/js_weak_container.h"
44 #include "ecmascript/js_map_iterator.h"
45 #include "ecmascript/containers/containers_arraylist.h"
46 #include "ecmascript/js_api/js_api_arraylist.h"
47 #include "ecmascript/builtins/builtins_function.h"
48 #include "ecmascript/builtins/builtins.h"
49 #include "ecmascript/ecma_global_storage.h"
50 #include "ecmascript/js_bigint.h"
51 #include "ecmascript/js_runtime_options.h"
52 #include "ecmascript/object_factory.h"
53 #include "ecmascript/tagged_array.h"
54 #include "ecmascript/js_generator_object.h"
55 #include "ecmascript/js_string_iterator.h"
56 #include "ecmascript/js_date_time_format.h"
57 #include "ecmascript/js_tagged_number.h"
58 #include "ecmascript/js_api/js_api_hashmap.h"
59 #include "ecmascript/builtins/builtins_regexp.h"
60 #include "ecmascript/js_regexp.h"
61 #include "ecmascript/tagged_hash_array.h"
62 #include "ecmascript/containers/containers_lightweightmap.h"
63 #include "ecmascript/containers/containers_lightweightset.h"
64 #include "ecmascript/js_api/js_api_plain_array.h"
65
66 using namespace panda;
67 using namespace panda::test;
68 using namespace panda::ecmascript;
69 using namespace panda::ecmascript::containers;
70
71 namespace OHOS {
CreateEcmaRuntimeCallInfo(JSThread * thread,JSTaggedValue newTgt,uint32_t argvLength)72 EcmaRuntimeCallInfo *CreateEcmaRuntimeCallInfo(JSThread *thread, JSTaggedValue newTgt, uint32_t argvLength)
73 {
74 const uint8_t testDecodedSize = 2;
75 int32_t numActualArgs = argvLength / testDecodedSize + 1;
76 JSTaggedType *sp = const_cast<JSTaggedType *>(thread->GetCurrentSPFrame());
77
78 size_t frameSize = 0;
79 if (thread->IsAsmInterpreter()) {
80 frameSize = InterpretedEntryFrame::NumOfMembers() + numActualArgs;
81 } else {
82 frameSize = InterpretedFrame::NumOfMembers() + numActualArgs;
83 }
84 JSTaggedType *newSp = sp - frameSize; // NOLINT(cppcoreguidelines-pro-bounds-pointer-arithmetic)
85 for (int i = numActualArgs; i > 0; i--) {
86 newSp[i - 1] = JSTaggedValue::Undefined().GetRawData();
87 }
88 EcmaRuntimeCallInfo *ecmaRuntimeCallInfo = reinterpret_cast<EcmaRuntimeCallInfo *>(newSp - 2);
89 *(--newSp) = numActualArgs;
90 *(--newSp) = common::ToUintPtr(thread);
91 ecmaRuntimeCallInfo->SetNewTarget(newTgt);
92 return ecmaRuntimeCallInfo;
93 }
94
SetupFrame(JSThread * thread,EcmaRuntimeCallInfo * info)95 static JSTaggedType *SetupFrame(JSThread *thread, EcmaRuntimeCallInfo *info)
96 {
97 JSTaggedType *sp = const_cast<JSTaggedType *>(thread->GetCurrentSPFrame());
98 size_t frameSize = 0;
99 const int num = 2;
100 // 2 means thread and numArgs
101 if (thread->IsAsmInterpreter()) {
102 frameSize = InterpretedEntryFrame::NumOfMembers() + info->GetArgsNumber() + NUM_MANDATORY_JSFUNC_ARGS + num;
103 } else {
104 frameSize = InterpretedFrame::NumOfMembers() + info->GetArgsNumber() + NUM_MANDATORY_JSFUNC_ARGS + num;
105 }
106 JSTaggedType *newSp = sp - frameSize; // NOLINT(cppcoreguidelines-pro-bounds-pointer-arithmetic)
107
108 InterpretedEntryFrame *state = reinterpret_cast<InterpretedEntryFrame *>(newSp) - 1;
109 state->base.type = ecmascript::FrameType::INTERPRETER_ENTRY_FRAME;
110 state->base.prev = sp;
111 state->pc = nullptr;
112 thread->SetCurrentSPFrame(newSp);
113 return sp;
114 }
115
TearDownFrame(JSThread * thread,JSTaggedType * prev)116 void TearDownFrame(JSThread *thread, JSTaggedType *prev)
117 {
118 thread->SetCurrentSPFrame(prev);
119 }
120
JSValueRefIsLinkedListIteratorFuzzTest(const uint8_t * data,size_t size)121 void JSValueRefIsLinkedListIteratorFuzzTest(const uint8_t *data, size_t size)
122 {
123 FuzzedDataProvider fdp(data, size);
124 const int arkProp = fdp.ConsumeIntegral<int>();
125 RuntimeOption option;
126 option.SetLogLevel(common::LOG_LEVEL::ERROR);
127 option.SetArkProperties(arkProp);
128 EcmaVM *vm = JSNApi::CreateJSVM(option);
129 {
130 JsiFastNativeScope scope(vm);
131 if (size <= 0) {
132 return;
133 }
134 auto thread = vm->GetAssociatedJSThread();
135 ObjectFactory *factory = thread->GetEcmaVM()->GetFactory();
136 JSHandle<GlobalEnv> env = thread->GetEcmaVM()->GetGlobalEnv();
137 JSHandle<JSTaggedValue> globalObject = env->GetJSGlobalObject();
138 JSHandle<JSTaggedValue> key(factory->NewFromASCII("ArkPrivate"));
139 JSHandle<JSTaggedValue> tagvalue =
140 JSObject::GetProperty(thread, JSHandle<JSTaggedValue>(globalObject), key).GetValue();
141 auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, JSTaggedValue::Undefined(), 6);
142 objCallInfo->SetFunction(JSTaggedValue::Undefined());
143 objCallInfo->SetThis(tagvalue.GetTaggedValue());
144 objCallInfo->SetCallArg(0, JSTaggedValue(static_cast<int>(containers::ContainerTag::LinkedList)));
145 [[maybe_unused]] auto prev = SetupFrame(thread, objCallInfo);
146 JSHandle<JSTaggedValue> contianer =
147 JSHandle<JSTaggedValue>(thread, containers::ContainersPrivate::Load(objCallInfo));
148 auto obj = factory->NewJSObjectByConstructor(JSHandle<JSFunction>(contianer), contianer);
149 JSHandle<JSAPILinkedList> linkedList = JSHandle<JSAPILinkedList>::Cast(obj);
150 JSTaggedValue doubleList = TaggedDoubleList::Create(thread);
151 linkedList->SetDoubleList(thread, doubleList);
152 uint32_t elementsNum = 256;
153 for (uint32_t i = 0; i < elementsNum; i++) {
154 JSHandle<JSTaggedValue> taggedvalue(thread, JSTaggedValue(i));
155 JSAPILinkedList::Add(thread, linkedList, taggedvalue);
156 }
157 JSHandle<JSTaggedValue> taggedValueHandle(thread, linkedList.GetTaggedValue());
158 JSHandle<JSAPILinkedListIterator> linkedListIterator(thread,
159 JSAPILinkedListIterator::CreateLinkedListIterator(thread, taggedValueHandle).GetTaggedValue());
160 JSHandle<JSTaggedValue> linkedListIteratortag = JSHandle<JSTaggedValue>::Cast(linkedListIterator);
161 Local<JSValueRef> object = JSNApiHelper::ToLocal<JSValueRef>(linkedListIteratortag);
162 object->IsLinkedListIterator(vm);
163 }
164 JSNApi::DestroyJSVM(vm);
165 }
166 }
167
168 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)169 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
170 {
171 // Run your code on data.
172 OHOS::JSValueRefIsLinkedListIteratorFuzzTest(data, size);
173 return 0;
174 }
175